IT IS CLAIMED: 



1. An apparatus for routing packets from a first network node to a second 
network node in a data network, comprising: 

5 means for assigning an ID to the first node that is associated with at least 

on VPN, wherein the ED is assigned by an entity other than the first node; 

means for receiving a packet from the first node, said packet including the 
ID associated with said first node, and including routing information for routing said 
packet to a destination address associated with said second node; 

10 means for examining the packet to identify the ID of the first node; and 

means for using said first node ID and routing information to determine 
whether said first node is associated with at least one VPN. 

2. The apparatus of claim 1 further comprising means for routing the packet 
15 to the second node. 

3. An apparatus of associating nodes in a data network with at least one 
virtual private network (VPN), the data network including an access network having at 
least one Head End device and a plurality of nodes, the access network further including at 

20 least one shared access channel utilized by a first and a second node of the plurality of 
nodes to communicate with the Head End device, said apparatus comprising: 

means for assigning an address to the first node that is associated with at least one 
VPN, wherein the address is assigned by an entity other than the first node; 

means for receiving a communication from the first node in the access network; 

25 means for identifying the address of the first node, wherein the address is specific 

to the network on which the first node resides; and 

means for using said address to determine whether said first node is associated 
with at least one VPN. 
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4. The apparatus of claim 3 further comprising means for mapping said first 
node to a particular sub-interface on the access network. 

5. An apparatus of associating nodes in a data network with at least one 
5 virtual private network (VPN), the data network including an access network having at 

least one Head End device and a plurality of nodes, the access network further including at 
least one shared access channel utilized by a first and a second node of the plurality of 
nodes to communicate with the Head End device, said apparatus comprising: 

means for determining whether said first node is a member of at least one VPN; 

10 and 

means for if it is determined that said first node is a member of at least one VPN, 
binding an ID of said node with said VPN to thereby cause said first node to be associated 
with said VPN, wherein the ID is bound with the node by an entity other than the node. 

15 6. The apparatus of claim 5 further including means for mapping a particular 

sub-interface of the Head End to said particular VPN. 

7. The apparatus of claim 22 further comprising: 

means for receiving at said Head End device a packet from said first node, said 
20 packet including a destination address corresponding to a second node in the network; 

means for examining said packet to identify the ID of said first node; and 

means for using said ID at said Head End device to determine whether said first 
node is a member of at least one VPN. 

25 8. The apparatus of claim 7 further comprising: 

means for if it is determined that said first node is a member of a first VPN, 
determining at said Head End device whether the destination address of said packet is 
within said first VPN. 
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9. The apparatus of claim 7 further comprising means for routing the packet 
to the second node. 

10. An apparatus for configuring a Head End of an access network to route 
5 packets from a first node to a second node in the access network, the apparatus 

comprising: 

means for associating particular network nodes on the access network with at least 
one corresponding virtual private network; 

means for assigning to the first node an ID specific to the access network, wherein 
10 the ED is assigned to the first node by an entity other than the first node; and 

means for associating the assigned ID with the first VPN to thereby cause the first 
node to be associated with the first VPN. 

11. The apparatus of claim 10 further means for including mapping a particular 
15 sub-interface of the Head End to the first VPN. 
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